I want to run elasticsearch from a docker container, and I'm going to run it on the same location I'm stashing my logs.
Is there a way to simply launch elastic search with a --logstash=/var/logstash/mylogs/ option, so that it will automatically slurp everything in ?
I'd like to use the default ELK container which has all 3, however, I'm using an external log stash. Can I choose disable the logstash in ELK or simply to use it as a 'second' read only view on an existing logstash folder that is in a shared mount ?
(Note that I'd rather not modify my existing logstash - elasticsearch is an optional endpoint for users, rather then being necessarily the final sink for everything).